This Schedule is the written contract that section 21(1) of POPIA requires between a responsible party (the Venue) and its operator (PosiTack). It forms part of the Terms of Service and uses the same definitions. Where this Schedule and the Terms conflict on the processing of personal information, this Schedule applies. Clauses 3.9, 5, 6.3 and 11 limit our obligations or place risk on you; they are boxed below and named in the sign-up acceptance tick-box.
1. Roles
1.1 For all personal information contained in Venue Data — your staff, job applicants, customers, guests, loyalty members, debtors, suppliers’ contacts and anyone else whose details you enter into the Service — you are the responsible party and PosiTack is your operator, as those terms are defined in POPIA.
1.2 For personal information about you and your Users that we collect for our own purposes (your account, billing, support, security logs, our marketing), we are the responsible party and our Privacy Policy applies, not this Schedule.
1.3 Your customers, staff and other data subjects are not parties to this Schedule. It does not give them rights against us, and it does not affect any right they may have under the law.
2. What we process, and why
2.1 Categories of data subjects: your employees and contractors; job applicants; your customers, diners, guests and loyalty members; parents booking events for children; your suppliers’ staff; your accountants, developers and other Users.
2.2 Categories of personal information: identity and contact details; South African ID or passport numbers and dates of birth; bank account details; employment details, pay rates, hours, leave, payroll and tax records (PAYE, UIF, SDL, IRP5 data), medical-aid and retirement-fund details; disciplinary and grievance records; clocking records and, if you enable it, fingerprint templates; order, booking, accommodation, payment and loyalty history; account balances and debtor records; QR-ordering session records; messages you send through the Service; and any free-text notes your Users enter.
2.3 Special personal information (POPIA section 26) that may be included: biometric (fingerprint) templates; health information (sick-leave, medical-aid and disciplinary records); trade-union membership (payroll deductions); and criminal behaviour (alleged offences recorded in disciplinary records, POPIA section 26(b)). You must have a lawful ground under section 27 (or, for criminal behaviour, section 33) of POPIA before entering any of it. Separately, children’s personal information (POPIA sections 34 and 35) may be included where a parent or guardian books an event or accommodation for a child; you must have a lawful ground under section 35 before entering it. We do not check that you have any of these grounds.
2.4 Purpose. We process personal information only to provide the Service to you as described in the Terms, to support you, to keep the Service secure, and as the law requires. We do not process it for our own purposes, do not sell it, and do not use it to train artificial-intelligence models.
2.5 Nature of processing: storage, retrieval, transmission, calculation (for example payroll), display, export, backup and deletion, performed automatically by the Service and, where needed for support, by our staff.
3. Our duties as operator (POPIA sections 20 and 21)
3.1 Only on your instructions. We process personal information only on your documented instructions, which are: the Terms, this Schedule, your configuration of the Service, and the actions you and your Users take in it. If we believe an instruction breaks POPIA we will tell you and may decline to follow it. We may process outside your instructions only where the law requires us to, in which case we tell you first unless the law forbids it.
3.2 Confidentiality. We treat personal information in Venue Data as confidential. Only our director, and any contractor who needs access to provide the Service or support and is bound by a written confidentiality undertaking, may access it. Administrative access through our admin console is logged.
3.3 Security (section 19). We maintain the security measures in clause 4.
3.4 Notification of a security compromise. See clause 5.
3.5 Sub-operators. See clause 6.
3.6 Cross-border. See clause 7.
3.7 Assistance. See clause 8.
3.8 Return and deletion. See clause 10.
4. Security measures (POPIA section 19)
4.1 We take the following measures, which we consider reasonable for a hosted software service of our size.
| Area | Measure |
|---|---|
| Hosting | Production servers are hosted in a data centre in Johannesburg, South Africa, on a virtual server with a host firewall and automatic blocking of repeated failed log-in attempts. Personal information is processed in South Africa; limited copies may be held on PosiTack-controlled systems in South Africa for support, backup and testing. Server access is restricted to our director and any contractor bound by a written confidentiality undertaking. |
| Transport | All connections to the Service use TLS (HTTPS). The website and API sit behind Cloudflare, which absorbs denial-of-service attacks. |
| Encryption at rest | Staff ID and passport numbers, tax and bank details, biometric templates, disciplinary and HR document contents, and gateway and integration credentials are encrypted in the database with AES-256-GCM using a key held outside the database. Passwords and staff PINs are stored as salted hashes. |
| Access control | Every venue’s data is isolated by tenant: the software refuses queries that are not tied to a venue. Within a venue, roles and permissions let you limit what each User sees. Sign-in tokens expire after 8 hours and are renewed while you remain signed in; PIN sessions on shared devices expire after 8 hours. |
| Logging | Authentication and administrative actions are recorded in the application’s audit records. Server logs are kept for a limited period for security and fault-finding. |
| Backups | Backup copies of the platform database are taken and stored in South Africa. They are deleted when they are no longer needed for disaster recovery. |
| Software | Operating-system security updates are installed automatically; we update our own software and its dependencies regularly. |
| People | Everyone with production access is bound by confidentiality and uses strong passwords. |
| Payments | Card details never reach our systems; they are handled by the Gateway. |
4.2 We may improve or change these measures provided the overall level of protection is not reduced. These are the measures we commit to. We do not commit to any measure or certification not listed here.
4.3 Your side. Security also depends on you: devices, passwords, PINs, permissions, removing former staff, and the PC running the Server Service. Clause 8 of the Terms applies.
5. Security compromises (POPIA sections 21(2) and 22)
6. Sub-operators
6.1 You authorise us to use the sub-operators below. Each is bound by written terms that require it to protect personal information and to process it only for the stated purpose.
| Sub-operator | Purpose | Location | Personal information involved | Used when |
|---|---|---|---|---|
| Diamatrix CC (Domains.co.za), our hosting provider | Runs our servers | Johannesburg, South Africa | All Venue Data | Always |
| Cloudflare, Inc. | Protects our website against attacks and delivers content; traffic passes through Cloudflare’s network on its way to our servers | United States (global network; traffic may be routed through data centres outside South Africa) | Connection data (IP address, headers) and data in transit | Always |
| Cloudflare, Inc. (Workers AI) | AI extraction of supplier-invoice text | United States (global network) | Supplier invoice and till-slip images and text | Only when you scan an invoice or till slip |
| Anthropic, PBC (Claude) | AI extraction of supplier-invoice text; Anthropic may not use it to train its AI models | United States | Supplier invoice and till-slip images and text | Only when you scan an invoice or till slip |
| Meta Platforms, Inc. (WhatsApp Business / Cloud API) | Sending WhatsApp messages you compose | United States | Recipient phone numbers and message content | Only if you connect WhatsApp (feature not yet live) |
| Intuit Inc. (QuickBooks) | Exporting your accounting data to your QuickBooks account | United States | Customer, supplier and transaction data you choose to sync | Only if you connect QuickBooks |
| Your payment Gateway (PayFast, Ozow, Transaction Junction, Yoco, Halo Dot, AddPay/PayCloud, Standard Bank PAX) | Processing payments | South Africa | Transaction amounts, references, customer email or phone where you or the customer supply it | When you use that Gateway |
| Your own email server (SMTP) | Sending emails from the Service in your name | Wherever your provider is | Recipient addresses and email content | If you configure your own mail server; otherwise our mail server in South Africa is used |
6.2 Gateways and your email provider act on your contract with them; they are your operators, not ours, but they are listed here for completeness.
6.4 We will require each sub-operator to protect personal information in line with clause 4 and will enforce those terms. Our liability for sub-operators is subject to clause 11.
7. Cross-border transfers (POPIA section 72)
7.1 Personal information in Venue Data is processed in South Africa: production is hosted in Johannesburg, backups are stored in South Africa, and limited copies may be held on PosiTack-controlled systems in South Africa for support, backup and testing. It leaves South Africa only in these cases: connection data passing through Cloudflare’s network; supplier invoices you send for AI scanning on Cloudflare Workers AI; WhatsApp messages you send via Meta (when that feature is available); and data you sync to QuickBooks (Intuit).
7.2 Each of these recipients is bound by a written agreement (its data-processing terms) that requires it to protect personal information substantially in line with POPIA’s conditions, which we rely on under section 72(1)(a). For AI scanning, WhatsApp and QuickBooks the transfer also happens only because you choose to enable the feature; by enabling it you instruct us to make the transfer and confirm you have a lawful ground for it.
7.3 We do not otherwise transfer Venue Data outside South Africa. If that changes we will follow clause 6.3.
8. Assisting you
8.1 Data subject requests. If your employee or customer asks you for access to, correction of, or deletion of their information, the Service’s own tools let you find, export, correct and delete records without our help. Where you need more, we will assist within 10 business days of a written request. Assistance of up to two hours per calendar year is free; beyond that we charge our standard rate of R450 per hour (including VAT). If a data subject contacts us directly about Venue Data, we will refer them to you and tell you.
8.2 Regulator requests and PAIA. We will help you respond to a request or enquiry from the Information Regulator concerning Venue Data, at our cost where it concerns our conduct and at your cost otherwise.
8.3 Impact assessments. If you need information about the Service for your own privacy impact assessment, we will provide the information in clauses 2, 4, 6 and 7 and answer reasonable questions in writing.
9. Your duties
9.1 You warrant that, for all personal information you enter into the Service, you have complied with POPIA’s conditions for lawful processing, including a lawful ground under section 11 (and sections 27, 33 and 35 for special, criminal-behaviour and children’s information), notification of data subjects under section 18, and any consent required for direct marketing under section 69.
9.2 You must enter only the personal information you need, keep it accurate, remove it when no longer needed, and configure User permissions appropriately.
9.3 You must not instruct us to process personal information in a way that breaches POPIA. You are responsible for the lawfulness of your instructions.
9.4 You indemnify us under clause 17 of the Terms for claims arising from your breach of this clause.
10. Return and deletion
10.1 While your account is active you may export Venue Data yourself (Terms clause 11.5). Once it is suspended or terminated, you may request an export by emailing support@positack.co.za within the export request window, which ends 30 days after termination. The export is free of charge; we provide it in a standard machine-readable format within 10 business days of your request (Terms clause 20.6(c)).
10.2 We delete personal information in Venue Data (including biometric templates) from our live systems, or permanently de-identify it so that it can no longer identify anyone, within 90 days after termination. Copies may remain in our backups until those backups are deleted; they stay protected under this Schedule and we do not restore an individual venue’s data from them. We keep only what clause 20.6(d) of the Terms allows. In particular, we keep payroll records (payslips, tax certificates such as IRP5/IT3(a), and leave records) for 5 years after termination to support your statutory record-keeping, processing them only for that purpose, and then delete them. We delete them sooner if you instruct us in writing by emailing privacy@positack.co.za.
10.3 On written request after deletion we will confirm in writing that it has been done.
10.4 Where the law requires us to keep any personal information longer, we keep it only for that purpose and for that period, and this Schedule continues to apply to it.
11. Liability
12. General
12.1 This Schedule lasts for as long as we hold personal information in Venue Data.
12.2 We may update this Schedule under clause 22 of the Terms. A change that reduces our obligations to you is a material change requiring 30 days’ notice.
12.3 Our Information Officer is Armand Charles Moss, privacy@positack.co.za, +27 83 439 4236, registered with the Information Regulator under number 2026-000958. Notices under this Schedule go to privacy@positack.co.za and to your account owner’s email address.
12.4 Clauses 21 and 23 of the Terms apply to this Schedule.